kucoin-loogin[.]webflow[.]io

This domain, kucoin-loogin.webflow.io, is identified as a brand impersonation threat targeting KuCoin, a cryptocurrency trading platform. Analysis indicates the page mimics the official KuCoin login interface, using the title 'KuCoin: L🏵g In | Sign In - KuCoin - Trading Platform' to deceive users into submitting credentials. No explicit drainer kit signatures were detected in initial scans, but the presence of a Unicode character (🏵) in the page title suggests an attempt to bypass basic text-based filters or appear visually legitimate to victims. The domain was designed to exploit trust in the KuCoin brand, likely aiming to capture login details for financial fraud or unauthorized account access. Technical indicators reveal the domain was registered on March 06, 2026, through MarkMonitor, Inc., and resolves to the IP address 172.64.151.8, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites to appear secure. At the time of analysis, the domain was flagged by 21 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on one security blocklist and is actively blocked by PhishDestroy. The creation date discrepancy (2026) suggests either a typo or an attempt to exploit future-dated records for evasion. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered, and similar campaigns may re-emerge using slight variations of the domain or IP. Organizations and users are advised to monitor for related indicators, including the IP 172.64.151.8 and the registrar MarkMonitor. Blocking the domain at the DNS or proxy level is recommended for network defense. Users who may have interacted with the site should reset credentials immediately and enable multi-factor authentication on financial accounts. The elevated risk level is retained due to the domain’s prior activity and potential for reuse.